Overview

overview

10

Static

static

3

CheckDevices3.exe

windows7-x64

8

CheckDevices3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 15:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CheckDevices3.exe

  • Size

    11KB

  • MD5

    13c01e851815420a4ff0891208918dbf

  • SHA1

    df6d7550f4fe60853609f1facec9255af9721a88

  • SHA256

    9097140491dca61a92e42fea7cc9b04a6fcb5854d4c678381a5fc4f7426e3a17

  • SHA512

    0d401005fcd5f4d066c734eacd5a1f891a5b91b6a21f7e176667f0829797ab204f95aeecec9f37836f8712dda28c13720b0cf8ab3a1c3f8e8e5966f3622ce2d2

  • SSDEEP

    192:bqqTSm4ENSn3fbfo5iX2KVFfcTkbS8cvD+3Hp3lTVJneqqpO0:L34ENSn3fbfo53KPcIbS1vS3J3NVIqqQ

Score
10/10
dcratxwormdiscoveryexecutioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %Temp%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/vJmE27fr

Extracted

Family

xworm

Version

3.0

C2

plus-loves.gl.at.ply.gg:59327

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Xworm Payload 4 IoCs
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\CheckDevices3.exe
    "C:\Users\Admin\AppData\Local\Temp\CheckDevices3.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1404
    • C:\Users\Admin\AppData\Local\Temp\CheckDevices.exe
      "C:\Users\Admin\AppData\Local\Temp\CheckDevices.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CheckDevices.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1568
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CheckDevices.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2000
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2276
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4460
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2312
      • C:\Users\Admin\AppData\Local\Temp\2XC8723860QOEL5.exe
        "C:\Users\Admin\AppData\Local\Temp\2XC8723860QOEL5.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2XC8723860QOEL5" /tr "C:\Users\Admin\AppData\Roaming\2XC8723860QOEL5.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1664
      • C:\Users\Admin\AppData\Local\Temp\FREQ0EIMRXCNYXC.exe
        "C:\Users\Admin\AppData\Local\Temp\FREQ0EIMRXCNYXC.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1256
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:556
            • C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
              "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4380
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5qd0s2da\5qd0s2da.cmdline"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:384
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DF1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE1E97988E144444A869B8036A4F41D2D.TMP"
                  8⤵
                    PID:2956
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tzsnbxkx\tzsnbxkx.cmdline"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4692
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E3F.tmp" "c:\Users\Admin\AppData\Roaming\CSCA7222A2F511C408BBCA8ABCB28E1165.TMP"
                    8⤵
                      PID:3460
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dblyjvyl\dblyjvyl.cmdline"
                    7⤵
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:2388
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EAC.tmp" "c:\Windows\System32\CSCC223854B1A7B4B3CBE8381165985E7D8.TMP"
                      8⤵
                        PID:4520
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\sysmon.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4964
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Modules\SppExtComObj.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1140
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\csrss.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3472
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\de-DE\Idle.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1992
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\fr-FR\winlogon.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1872
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1768
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\C37IDIIoCN.bat"
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4768
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        8⤵
                          PID:2388
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          8⤵
                            PID:3608
                          • C:\Windows\Migration\sysmon.exe
                            "C:\Windows\Migration\sysmon.exe"
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1056
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1808
            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
              C:\Users\Admin\AppData\Local\Temp\svchost.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:880
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\sysmon.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1288
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Migration\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2968
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\sysmon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1044
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Modules\SppExtComObj.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2928
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\SppExtComObj.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4544
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Modules\SppExtComObj.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3452
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\csrss.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1980
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\csrss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3676
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\csrss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1624
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\Idle.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3608
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\Idle.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:448
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\Idle.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3124
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\fr-FR\winlogon.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4536
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2272
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\fr-FR\winlogon.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4292
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 11 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3216
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "hyperSurrogateagentCrt" /sc ONLOGON /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1000
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 7 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2324
            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
              C:\Users\Admin\AppData\Local\Temp\svchost.exe
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:736
              • C:\Windows\Migration\sysmon.exe
                "C:\Windows\Migration\sysmon.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3112
              • C:\Users\Admin\AppData\Local\Temp\svchost.exe.exe
                "C:\Users\Admin\AppData\Local\Temp\svchost.exe.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4800
            • C:\Users\Admin\AppData\Roaming\2XC8723860QOEL5.exe
              C:\Users\Admin\AppData\Roaming\2XC8723860QOEL5.exe
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:2520
              • C:\Windows\Migration\sysmon.exe
                "C:\Windows\Migration\sysmon.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:324
              • C:\Users\Admin\AppData\Roaming\2XC8723860QOEL5.exe.exe
                "C:\Users\Admin\AppData\Roaming\2XC8723860QOEL5.exe.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4684

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe
              Filesize

              220B

              MD5

              47085bdd4e3087465355c9bb9bbc6005

              SHA1

              bf0c5b11c20beca45cc9d4298f2a11a16c793a61

              SHA256

              80577e4666fad86273b01f60b8d63c15e4ce37774575ac1e0df7a7c396979752

              SHA512

              e74dd8e9756cab1123410a46609dc91540cc29a8fea93017155746f7bb9b7a41bfd3d7595a62788264bedceb475b2a733cce9b70f37cc4478302d5fc228d7684

              Download Submit

            • C:\HypercomponentCommon\cemEzm0xYx1.bat
              Filesize

              105B

              MD5

              5ee2935a1949f69f67601f7375b3e8a3

              SHA1

              6a3229f18db384e57435bd3308298da56aa8c404

              SHA256

              c24a0d7f53a7aa3437f6b6566d3aaebdb36053b64e72cbd1d3796596fc8e3c06

              SHA512

              9777fcb9ee8a8aa0c770c835c5f30aff6efc5fb16a1819047e13d580d748703ffcb446db110067fb2546a637213cb8f25416d4b621a95a789b8e113d31d3401a

              Download Submit

            • C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
              Filesize

              1.9MB

              MD5

              7be5cea1c84ad0b2a6d2e5b6292c8d80

              SHA1

              631e3de0fe83ebacbe5be4e7f895dd0bd8b095ce

              SHA256

              6eb90684ebc56fb2713f5c468b55a964625ec2af698d9687492b1de4225693b7

              SHA512

              ea58d3b1664fe70968635c2722e19ce65ce4c1d66c68aed2d98441e60e773c7295f18d9c99cf4c454c510f33f5e37d3d2c0053b7434a46c542a0d63a4cc03647

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
              Filesize

              654B

              MD5

              2ff39f6c7249774be85fd60a8f9a245e

              SHA1

              684ff36b31aedc1e587c8496c02722c6698c1c4e

              SHA256

              e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

              SHA512

              1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
              Filesize

              847B

              MD5

              66a0a4aa01208ed3d53a5e131a8d030a

              SHA1

              ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1

              SHA256

              f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8

              SHA512

              626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              968cb9309758126772781b83adb8a28f

              SHA1

              8da30e71accf186b2ba11da1797cf67f8f78b47c

              SHA256

              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

              SHA512

              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              b8fadb3ef36dee95618d6cff79826132

              SHA1

              35dd0e2059c3d9713814ee10cd640acdf4ed589b

              SHA256

              4adf629de8260ba2f29013f2db2ccec937c47f4d1a1ea766bb2b93f8cfd50e94

              SHA512

              c133e54f241eadba0f46cf0514f4ade94f6644e8d183760416ea878006da96640a87e9ffe268ef78b678d5a5b7edecd02c26325d0834242381fa3390a012227a

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              9b80cd7a712469a4c45fec564313d9eb

              SHA1

              6125c01bc10d204ca36ad1110afe714678655f2d

              SHA256

              5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

              SHA512

              ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              c08aea9c78561a5f00398a723fdf2925

              SHA1

              2c880cbb5d02169a86bb9517ce2a0184cb177c6e

              SHA256

              63d2688b92da4d1bb69980b7998b9be1595dd9e53951434a9414d019c4f825a7

              SHA512

              d30db2f55bbda7102ffe90520d233355633313dcc77cdb69a26fdbb56e59dd41793def23d69dc5dc3f94c5bd41d3c26b3628886fd2edbed2df0b332e9a21f95c

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              fd98baf5a9c30d41317663898985593b

              SHA1

              ea300b99f723d2429d75a6c40e0838bf60f17aad

              SHA256

              9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

              SHA512

              bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              98baf5117c4fcec1692067d200c58ab3

              SHA1

              5b33a57b72141e7508b615e17fb621612cb8e390

              SHA256

              30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51

              SHA512

              344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              54522d22658e4f8f87ecb947b71b8feb

              SHA1

              6a6144bdf9c445099f52211b6122a2ecf72b77e9

              SHA256

              af18fc4864bc2982879aed928c960b6266f372c928f8c9632c5a4eecd64e448a

              SHA512

              55f2c5a455be20dcb4cb93a29e5389e0422237bdd7ac40112fec6f16a36e5e19df50d25d39a6d5acb2d41a96514c7ecd8631ce8e67c4ff04997282f49d947aba

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              4165c906a376e655973cef247b5128f1

              SHA1

              c6299b6ab8b2db841900de376e9c4d676d61131e

              SHA256

              fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4

              SHA512

              15783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              04114c0529b116bf66d764ff6a5a8fe3

              SHA1

              0caeff17d1b2190f76c9bf539105f6c40c92bd14

              SHA256

              fd7092b4e273314186bad6ce71aa4cd69450736b6ec6cc746868997ff82a7532

              SHA512

              6a718c330824346606ef24f71cca6be0bfafc626b1d2b060b36e919ab07f3d6a345f56cace8a5a84ffbe2183976eb197842c9fd2f3e3b8c8dd307057d59d6f26

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              10890cda4b6eab618e926c4118ab0647

              SHA1

              1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

              SHA256

              00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

              SHA512

              a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              400B

              MD5

              601c3d793dcc50b2e9cef2122604dd3f

              SHA1

              cbd06a765dcb32d92f93d8e7cf416c99660653b5

              SHA256

              0a1bf53ecdb0c9870da989ff4e73082dd39d61a1853a0b6826858ebba908ce6c

              SHA512

              9e51922e77b79ade0af5ce9d4958d64768582262d37ecf7a0aa2a075a145f0276d5f3cdcbf63acb4ced071933b036d0aaac7e7acc05b74fb6e48c04d8bcde944

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              65c8248664c93a77b43cda611dd70ec6

              SHA1

              9892e50e4967c512896c467a7f7c7eb87cb7f6e3

              SHA256

              7d0360e554e39c5da93202bd39a5f30981066c9eedcc5993b420fee715fd3bfd

              SHA512

              16f9e99d3fa802c91e334f147c53c3d769cce859dd6cf10ba15c5dc56540c44a294cc8f6f34a351589da3f9b13e1a0fd7c6b816591b6370cf7cd82e3ddd18d25

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\2XC8723860QOEL5.exe
              Filesize

              185KB

              MD5

              e0c8976957ffdc4fe5555adbe8cb0d0c

              SHA1

              226a764bacfa17b92131993aa85fe63f1dbf347c

              SHA256

              b8260ac46e03f2a7baa9ae01bee5443d16d9eb96f6ee8588a887d6de72a750d4

              SHA512

              3a1ea48e81ebfd5586938a72afd68bcc48d4c5d69949cfdacf33aee3371d98f202443f5db12bac876ca7cecc982ddc56827f8d9b1857d22bda71242d5b2cc71e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\C37IDIIoCN.bat
              Filesize

              207B

              MD5

              1c0904573a7835786fe435524c78530b

              SHA1

              a4320884077cfa41583fa00a4a9aa6a6d77e60e3

              SHA256

              6d6a7e34e3a00ce1a505eaa15743a3910391ad2c22372a20cd635f9cc91c3015

              SHA512

              e6e03bca487f5d2275f17e6fa253e8ac0f4993173606cce1f3fa8d28e962cd62b16fd637cacde66aa1b1e5a837cb8d6f970a5cd8025f002b81a4a904e7e903a5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\CheckDevices.exe
              Filesize

              56KB

              MD5

              35ef4221e32b4db80e705a9bec92159d

              SHA1

              cee217493ccff1a416207edc73ed3876c73682ec

              SHA256

              29f7c51fd74c6a33fbc348afa4ab1ec9683eaf0461bd1073815bb3ec1833574e

              SHA512

              92a3e12ff9bfdfff97ef6ff8fa08cad9e2e4dedd5147b6348c3639300562ab443e3b35547e1a6a76f757fa7dc03af2a6b18af0c639ee5d814d2be1b4bc4e998f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\FREQ0EIMRXCNYXC.exe
              Filesize

              2.2MB

              MD5

              05d87a4a162784fd5256f4118aff32af

              SHA1

              484ed03930ed6a60866b6f909b37ef0d852dbefd

              SHA256

              7e3d0dabaded78094abfac40d694eaebf861f3cb865d3835bb053d435e996950

              SHA512

              3d4ce511e9671d8bfa15e93d681fedd972f4fe4c09ac9cfd9653afe83e936654c88ee515a76e7ac80e8f34868802e68c6531fdea0b718029d2196ad1425981fc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES9DF1.tmp
              Filesize

              1KB

              MD5

              b6a4e728ccfacff3d2f2fb2eb331415c

              SHA1

              5e36541bbf159411f4225a3b4abedaec12ac15e8

              SHA256

              dffb260dbb8c79fb4d489fee99bb41662d932b96961ced169d0d5fdbfd003057

              SHA512

              9f4c413f9efa0c263a4536c81041bcc323ccdf4b79ce1e4607e0bbd2527a7e22c065c5b0da728cdf8f49e5ea4d778447690223deab45cc50cbd14c0f8858d5bb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES9E3F.tmp
              Filesize

              1KB

              MD5

              a1d90c9293742e0838aad58ba29deb90

              SHA1

              295b39e0f4a8e2b0890b85b18e13d5f58f4c29a9

              SHA256

              6397e7d57538fae4359184d68d05bb531a03d4ffad390db4caab58225f549b18

              SHA512

              135c8d370b94ac733788ffc7a52a1fe0cbe4224962fec44c4c71f4f21a6de52fdd1bcf77a9553e386212880cd86419c37610ef00d17d9d5e1c5dbf2d19f9e48c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES9EAC.tmp
              Filesize

              1KB

              MD5

              20febb9ea2dc6a23d366d215af9e629b

              SHA1

              e183d76a08f5ee5e4ae741754be0e6cfc71f0f73

              SHA256

              b9091069db061f0c67d0ee0284b7e14b5732ba769ac6cf02e319e5e16cf55a0f

              SHA512

              892a900cf75cf13d0f1ee2c3109c2687bac9dbdd48e3e93a6a557909bfbfd4f5b7cce7a0547ce01d5701ebb11c7f141c3584d24f3d7ef611aa061719027917a2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gb0bj15y.cyv.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
              Filesize

              4KB

              MD5

              c377e2cdd1ad68c261e0117385029a67

              SHA1

              28b279a6fa68c06f8cd844815177bd9b6d69914d

              SHA256

              5b8a60ef1757a580db2f4a180af1b339fbfd55dabcb771fba2e9b5c8303d089c

              SHA512

              fc98b3d5fc631e92cd043c472c82ca635971475c4c22f7a92020e7bd4e694bcc0776fb955ee5e4cf2f2dac9275fd76b11ca85eb35134e7f2e601519b66686a2f

              Download Submit

            • C:\Users\Admin\AppData\Roaming\2XC8723860QOEL5.exe
              Filesize

              4KB

              MD5

              9d8691e18e320cbcd82bfab179884666

              SHA1

              7d69eca1bf6dc1d45d8c26f856faad0cab0a668f

              SHA256

              1bae36894405fc4409c426d1cc3f448d30bb28c6e4c58ed52abd149374c9ad06

              SHA512

              77a5909ffe51f184aaca33bb49796b2f1d1f9c971c89596eae8d33e24b6575e7b46d276b49be71dc4c0991a063e9eb99b72201c5e3592c34c4f087560855999d

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\5qd0s2da\5qd0s2da.0.cs
              Filesize

              378B

              MD5

              fef3dbe1073ded0fef7d9e8860a035a9

              SHA1

              0c9406fdc9e4afdb2098cec0b9933b6683c70be8

              SHA256

              7c521b44111d101e5c9b88d180309c5230112847c45bc97446175abfff57e20d

              SHA512

              43ed575414d3076cdce89e1fb6771ce7b237423763b464895e5a8499d1ee9e32a857271bb6a77b08eb0052837b21d673010373b833efb8f7620730224d2e3fa5

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\5qd0s2da\5qd0s2da.cmdline
              Filesize

              250B

              MD5

              a3663579237f95d088a4c643ac125675

              SHA1

              e63050bc42b77f34ed316292f3a9033d9041071e

              SHA256

              d0fbdcaffef816b953c8489ec3947bd168da4b9db6da20aa279c7c9728b8950f

              SHA512

              6a9dcb56f96ea5c4d748c48a30ebe4ef37ede49eedd9a0e4945babef008f0683ab79b7a928d5c0e17fe186d44241fb0aacfe7c042c9dfaa9248fef247587e9ec

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\CSCE1E97988E144444A869B8036A4F41D2D.TMP
              Filesize

              1KB

              MD5

              b10290e193d94a5e3c95660f0626a397

              SHA1

              7b9de1fd7a43f6f506e5fc3426836b8c52d0d711

              SHA256

              75c9e1766bfb99754b6a00d37ef93488ab216b5ac48984ed7d9d2076a7056fd2

              SHA512

              6ae4201552a499eaa726416b29230f48d94ac7f40ff038165bf8582626bbefe601ef6c051ad97d9156dc4b9b55fd22081db61bcd013916136340c5f1324e4bb5

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\dblyjvyl\dblyjvyl.0.cs
              Filesize

              363B

              MD5

              8eb5a4f06f69f67edcb1e6cce240c440

              SHA1

              028b69deb77329b23dd7b73bd40452a1f96d40b9

              SHA256

              d4e7f06c4f054311a6efa4d216e90dfcf1e30ed077675b6e8bda7a498500d711

              SHA512

              231795ce0064b18ec247968abdba5c10bb20e8f46dde294280242b3b1bd5a6db131140fa3e253c6a96c3e208da3cb8d6520712e2dad3d2cd275524b55be014d0

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\dblyjvyl\dblyjvyl.cmdline
              Filesize

              235B

              MD5

              4e42b826f952bc09cbbd903bbec6d7b4

              SHA1

              47d5ce3bc4d22aec3cf29f58a39c4e7c0d23fa11

              SHA256

              5602ad60e1d905170726095e71567c4223fc398ed9b10c939701c01097d8ea66

              SHA512

              7803bb3a2b1ae4eb6f31d601677596ba8cca8b566cae55be1bd9551bf62373180dc0d32c214567a05f0ab94ac699fcd89ab13e8974f4cd549b987cb5a442a86a

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\tzsnbxkx\tzsnbxkx.0.cs
              Filesize

              383B

              MD5

              f1f8920401e5aa41bc6e6f6ceb16b503

              SHA1

              cb1a78132c107d8bab1587be5403d24ed5d3103c

              SHA256

              b15926a58cc1f84ea759e7b6bfa37532e707825586d5f11c5a1f7f4713b1d756

              SHA512

              433c357762978fc3cdde8580d1a9ddce41c00611e066f8e9ab781887569212c96c5efb8462ac94d984e933d0ced9b71cfc0e1f25c806d4b22850c69896e8c8b1

              Download Submit

            • \??\c:\Users\Admin\AppData\Local\Temp\tzsnbxkx\tzsnbxkx.cmdline
              Filesize

              255B

              MD5

              9a260b6c1be84fbc9074bd01e9467bc8

              SHA1

              8dc351664d6177384c38e853cfae516827c2b186

              SHA256

              4936e369f009798f06b88089d3ec435efcb47d4a4c6ebb670973a91a702fc65a

              SHA512

              bbe18461d6338d01e6436d16613483082f44f5be66c17701634c373225ee54ea73807c0b66e177608758a4405fa6b6be314c3c0c250de97bf401efdaedc72392

              Download Submit

            • \??\c:\Users\Admin\AppData\Roaming\CSCA7222A2F511C408BBCA8ABCB28E1165.TMP
              Filesize

              1KB

              MD5

              02ddb0c1c61d143dfff6b68ec1fd448c

              SHA1

              44bda0d395069de5432db8b9bdee662f242a1c0f

              SHA256

              ecdadba7ae6c7387e61dcba337e55b590594e911f299067ee10b270a5bfdfb67

              SHA512

              077c069c618acac33ccdb76132f3a416a3fbea04944e224f6a30e9c3bb93938b5e5bf5c573d8c7b5dd869160e4cb918a87d53a2b26c582de1afa8ea7378c3596

              Download Submit

            • \??\c:\Windows\System32\CSCC223854B1A7B4B3CBE8381165985E7D8.TMP
              Filesize

              1KB

              MD5

              be99f41194f5159cc131a1a4353a0e0a

              SHA1

              f24e3bf06e777b4de8d072166cff693e43f2295c

              SHA256

              564d9051e5639603c83562a9ff2c2e478cc7e13d54faf39f761297bac78603bf

              SHA512

              51d1a50772bb7d689193e6a9b2e363185cf5438103644b2b68cf13e08274c5d99407b99f8cdc856143d28669f5ee4ee316041a8e33df42f55bfd181aa3f3c0f5

              Download Submit

            • memory/736-335-0x0000000000140000-0x0000000000148000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1056-330-0x000000001BB70000-0x000000001BC3D000-memory.dmp

              Filesize

              820KB

              Download

            • memory/1404-12-0x0000000005980000-0x00000000059E6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/1404-9-0x0000000005A20000-0x0000000006048000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/1404-25-0x0000000006E80000-0x0000000006EB2000-memory.dmp

              Filesize

              200KB

              Download

            • memory/1404-51-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1404-26-0x0000000070210000-0x000000007025C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1404-7-0x0000000005300000-0x0000000005336000-memory.dmp

              Filesize

              216KB

              Download

            • memory/1404-8-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1404-47-0x0000000007F10000-0x0000000007F2A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1404-46-0x0000000007E10000-0x0000000007E24000-memory.dmp

              Filesize

              80KB

              Download

            • memory/1404-45-0x0000000007E00000-0x0000000007E0E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/1404-44-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1404-43-0x0000000007E50000-0x0000000007EE6000-memory.dmp

              Filesize

              600KB

              Download

            • memory/1404-10-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1404-42-0x0000000007C50000-0x0000000007C5A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/1404-11-0x00000000058E0000-0x0000000005902000-memory.dmp

              Filesize

              136KB

              Download

            • memory/1404-41-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1404-40-0x0000000008250000-0x00000000088CA000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/1404-39-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1404-38-0x0000000007B20000-0x0000000007BC3000-memory.dmp

              Filesize

              652KB

              Download

            • memory/1404-48-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1404-19-0x00000000060C0000-0x0000000006414000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/1404-23-0x0000000006890000-0x00000000068AE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1404-24-0x0000000006920000-0x000000000696C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1404-27-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1404-37-0x0000000006E60000-0x0000000006E7E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/1568-93-0x0000023F6DCF0000-0x0000023F6DD12000-memory.dmp

              Filesize

              136KB

              Download

            • memory/1808-74-0x00000000056A0000-0x00000000059F4000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/1808-79-0x000000006F510000-0x000000006F55C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1808-89-0x0000000006E50000-0x0000000006EF3000-memory.dmp

              Filesize

              652KB

              Download

            • memory/1808-91-0x0000000007160000-0x0000000007174000-memory.dmp

              Filesize

              80KB

              Download

            • memory/1808-76-0x0000000006120000-0x000000000616C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/1808-90-0x0000000007120000-0x0000000007131000-memory.dmp

              Filesize

              68KB

              Download

            • memory/2520-340-0x0000000000230000-0x0000000000238000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2740-146-0x0000000002EA0000-0x0000000002EAC000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2740-63-0x0000000000E00000-0x0000000000E14000-memory.dmp

              Filesize

              80KB

              Download

            • memory/3204-5-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3204-3-0x0000000005410000-0x00000000054A2000-memory.dmp

              Filesize

              584KB

              Download

            • memory/3204-4-0x0000000005400000-0x000000000540A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3204-77-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3204-1-0x0000000000A00000-0x0000000000A0A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3204-2-0x0000000005AA0000-0x0000000006044000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/3204-78-0x0000000074A60000-0x0000000075210000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3204-6-0x0000000006650000-0x00000000066B6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/3204-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4380-193-0x000000001C210000-0x000000001C260000-memory.dmp

              Filesize

              320KB

              Download

            • memory/4380-199-0x0000000003500000-0x000000000350C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/4380-190-0x00000000033B0000-0x00000000033BE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/4380-188-0x0000000000FC0000-0x00000000011A6000-memory.dmp

              Filesize

              1.9MB

              Download

            • memory/4380-308-0x000000001C4A0000-0x000000001C56D000-memory.dmp

              Filesize

              820KB

              Download

            • memory/4380-195-0x0000000003530000-0x0000000003548000-memory.dmp

              Filesize

              96KB

              Download

            • memory/4380-197-0x00000000034F0000-0x00000000034FE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/4380-192-0x0000000003510000-0x000000000352C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4476-158-0x00000000001F0000-0x0000000000224000-memory.dmp

              Filesize

              208KB

              Download